{
	"id": "2bdfd72b-8bf8-4a42-802f-6264fa2124e9",
	"created_at": "2026-04-06T00:08:24.092189Z",
	"updated_at": "2026-04-10T03:33:49.091256Z",
	"deleted_at": null,
	"sha1_hash": "fecd9c2daaa9b7a3b7e1e386e3ae3c3d06925851",
	"title": "Shadow Academy - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 45130,
	"plain_text": "Shadow Academy - Threat Group Cards: A Threat Actor\nEncyclopedia\nArchived: 2026-04-05 17:26:50 UTC\nHome \u003e List all groups \u003e Shadow Academy\n APT group: Shadow Academy\nNames Shadow Academy (RiskIQ)\nCountry [Unknown]\nMotivation Information theft and espionage\nFirst seen 2020\nDescription\n(RiskIQ) In early July 2020, RiskIQ began tracking a phishing campaign identified through\nour internet intelligence graph targeting colleges and universities worldwide. From July 2020\ninto October 2020, RiskIQ systems uncovered 20 unique targets in Australia, Afghanistan, the\nUK, and the USA.\nAll these attacks used similar tactics, techniques, and procedures (TTPs) as Mabna Institute,\nCobalt Dickens, Silent Librarian, an Iranian company that, according to the FBI, was created\nfor illegally gaining access 'to non-Iranian scientific resources through computer intrusions.'\nMabna Institute earned the moniker 'Silent Librarian' due to its focused efforts to compromise\nuniversity students and faculty by impersonating university library resources using domain\nshadowing to harvest credentials.\nHowever, while RiskIQ's findings are consistent with TTPs in use by Silent Librarian, they\nalone are not sufficient to attribute the threat activity we've detected against these 20\nuniversities directly to Mabna Institute. Therefore, RiskIQ has named actors identified during\nthis research as 'Shadow Academy.'\nObserved\nSectors: Education.\nCountries: Afghanistan, Australia, UK, USA.\nTools used\nInformation Last change to this card: 06 January 2021\nDownload this actor card in PDF or JSON format\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=291f5c4f-f25f-4a84-824a-0dc010179887\nPage 1 of 2\n\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=291f5c4f-f25f-4a84-824a-0dc010179887\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=291f5c4f-f25f-4a84-824a-0dc010179887\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=291f5c4f-f25f-4a84-824a-0dc010179887"
	],
	"report_names": [
		"showcard.cgi?u=291f5c4f-f25f-4a84-824a-0dc010179887"
	],
	"threat_actors": [
		{
			"id": "3153308a-c34e-4a02-a179-2987fec3805b",
			"created_at": "2022-10-25T16:07:24.169458Z",
			"updated_at": "2026-04-10T02:00:04.887975Z",
			"deleted_at": null,
			"main_name": "Shadow Academy",
			"aliases": [],
			"source_name": "ETDA:Shadow Academy",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "610a7295-3139-4f34-8cec-b3da40add480",
			"created_at": "2023-01-06T13:46:38.608142Z",
			"updated_at": "2026-04-10T02:00:03.03764Z",
			"deleted_at": null,
			"main_name": "Cobalt",
			"aliases": [
				"Cobalt Group",
				"Cobalt Gang",
				"GOLD KINGSWOOD",
				"COBALT SPIDER",
				"G0080",
				"Mule Libra"
			],
			"source_name": "MISPGALAXY:Cobalt",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "adc8bb1a-6ded-4b27-8163-8069d5a6d492",
			"created_at": "2022-10-25T15:50:23.566869Z",
			"updated_at": "2026-04-10T02:00:05.385876Z",
			"deleted_at": null,
			"main_name": "Silent Librarian",
			"aliases": [
				"Silent Librarian",
				"TA407",
				"COBALT DICKENS"
			],
			"source_name": "MITRE:Silent Librarian",
			"tools": null,
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "42e41377-c64c-4be9-87a0-ee903e4b9055",
			"created_at": "2023-01-06T13:46:38.950322Z",
			"updated_at": "2026-04-10T02:00:03.158476Z",
			"deleted_at": null,
			"main_name": "Silent Librarian",
			"aliases": [
				"Mabna Institute",
				"TA407",
				"TA4900",
				"Yellow Nabu",
				"COBALT DICKENS"
			],
			"source_name": "MISPGALAXY:Silent Librarian",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "d4c0e20f-e199-448e-9056-88bb1cf1c63e",
			"created_at": "2025-08-07T02:03:24.717633Z",
			"updated_at": "2026-04-10T02:00:03.630245Z",
			"deleted_at": null,
			"main_name": "COBALT DICKENS",
			"aliases": [
				"ITG22 ",
				"SilentLibrarian ",
				"TA407 ",
				"Yellow Nabu "
			],
			"source_name": "Secureworks:COBALT DICKENS",
			"tools": [],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "7ba9e3e3-1cef-4e20-be7e-95f05e8295d7",
			"created_at": "2022-10-25T16:07:23.821494Z",
			"updated_at": "2026-04-10T02:00:04.759302Z",
			"deleted_at": null,
			"main_name": "Mabna Institute",
			"aliases": [
				"Academic Serpens",
				"Cobalt Dickens",
				"G0122",
				"Mabna Institute",
				"Silent Librarian",
				"TA407",
				"TA4900",
				"Yellow Nabu"
			],
			"source_name": "ETDA:Mabna Institute",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434104,
	"ts_updated_at": 1775792029,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/fecd9c2daaa9b7a3b7e1e386e3ae3c3d06925851.pdf",
		"text": "https://archive.orkl.eu/fecd9c2daaa9b7a3b7e1e386e3ae3c3d06925851.txt",
		"img": "https://archive.orkl.eu/fecd9c2daaa9b7a3b7e1e386e3ae3c3d06925851.jpg"
	}
}